OpenJDK 11.0.16 for Fedora 36

FEDORA-2022-ae563934f7 created by ahughes a year ago for Fedora 36

New in release OpenJDK 11.0.16 (2022-07-19)

Security fixes

  • JDK-8277608: Address IP Addressing
  • JDK-8272243: Improve DER parsing
  • JDK-8272249: Better properties of loaded Properties
  • JDK-8281859, CVE-2022-21540: Improve class compilation
  • JDK-8281866, CVE-2022-21541: Enhance MethodHandle invocations
  • JDK-8283190: Improve MIDI processing
  • JDK-8284370: Improve zlib usage
  • JDK-8285407, CVE-2022-34169: Improve Xalan supports

FIPS Changes

  • RH2007331: SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode
  • RH2036462: breakage
  • RH2090378: Revert to disabling system security properties and FIPS mode support together
  • Depend on crypto-policies package at build-time and run-time

Other Changes

  • Add javaver- and origin-specific javadoc and javadoczip alternatives (thanks to FeRD (Frank Dana)

JDK-8285240: HTTPS Channel Binding support for Java GSS/Kerberos

Support has been added for TLS channel binding tokens for Negotiate/Kerberos authentication over HTTPS through

Channel binding tokens are increasingly required as an enhanced form of security which can mitigate certain kinds of socially engineered, man in the middle (MITM) attacks. They work by communicating from a client to a server the client's understanding of the binding between connection security (as represented by a TLS server cert) and higher level authentication credentials (such as a username and password). The server can then detect if the client has been fooled by a MITM and shutdown the session/connection.

The feature is controlled through a new system property jdk.https.negotiate.cbt which is described fully at the following page:

JDK-8278386: Default JDK compressor will be closed when IOException is encountered

DeflaterOutputStream.close() and GZIPOutputStream.finish() methods have been modified to close out the associated default JDK compressor before propagating a Throwable up the stack. ZIPOutputStream.closeEntry() method has been modified to close out the associated default JDK compressor before propagating an IOException, not of type ZipException, up the stack.

JDK-8277157: Vector should throw ClassNotFoundException for a missing class of an element

java.util.Vector is updated to correctly report ClassNotFoundException that occurs during deserialization, object)when the class of an element of the Vector is not found. Without this fix, aStreamCorruptedException` is thrown that does not provide information about the missing class.

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2022-ae563934f7

This update has been submitted for testing by ahughes.

a year ago

This update's test gating status has been changed to 'ignored'.

a year ago

ahughes edited this update.

a year ago

This update has been pushed to testing.

a year ago
User Icon filiperosset commented & provided feedback a year ago

no regressions noted

User Icon pwalter commented & provided feedback a year ago


This update can be pushed to stable now if the maintainer wishes

a year ago

This update has been submitted for stable by bodhi.

a year ago

This update has been pushed to stable.

a year ago

Please login to add feedback.

Content Type
Test Gating
Unstable by Karma
Stable by Karma
Stable by Time
7 days
a year ago
in testing
a year ago
in stable
a year ago
a year ago

Automated Test Results